topic Re: Inheriting and security model in Alfresco in Alfresco Archive

Inheriting and security model in Alfresco

ivanatap — Wed, 07 Nov 2012 15:37:25 GMT

Hi,I have a problem to configure security model with using inheritance feature.By default all folders inherit "Everyone - Consumer" permission.Without that setting users from my system would not be able to navigate folders.Here is my bussiness solution.I have site folder "Company documents" under si

Re: Inheriting and security model in Alfresco

abarisone — Wed, 07 Nov 2012 15:55:32 GMT

Hi,
I had a similar experience, and basically I tried to organize the repository matching the hierarchical organization thinking about requirements in terms of business objects and not only in terms of documents or folders.
Moreover I tried to obtain a segmentation of the repository in order to avoid the number of objects to grow up beyond 500/600 objects per container.
I managed to build up trees of folders each of them inheriting security from the respective container, and using webscirpts I added, modified and deleted authorities as needed.
To locate the roots of these trees, I used lucene path queries that allowed me to replicate the same structure many times (it was a company business object) and access every single object securely.
Obviously this is a matter of opinion, there may be better solutions depending on your requirements.

Regards,
Andrea

Re: Inheriting and security model in Alfresco

ivanatap — Thu, 08 Nov 2012 14:24:53 GMT

Hi,

Thank you for your answer.
Are you using Alfresco Share or Alfresco Explorer as web client?
If I understand you right, you are using lucene path queries to navigate folders that users should access, because they don't have rights on parent node?

Best regards,
Ivana

Re: Inheriting and security model in Alfresco

abarisone — Thu, 08 Nov 2012 14:33:40 GMT

Hi,
well as web client I use Alfresco Explorer, even if for my project I use a custom client application…
But yes, if you're searching for nodes with lucene path queries you're assured that the user performing the action will find all nodes he has rights on.
Then, if you have properly organized your repository, you will always get one matching result (or zero in case of fault)
This is also a good way to manage nodes at a presentation level, making they look like as if they were in the same folder even if they are not.

Regards,
Andrea

Re: Inheriting and security model in Alfresco

ivanatap — Fri, 09 Nov 2012 07:39:00 GMT

Hi,

I understood. I didn't try lucene search, but as you said, it works the same like ordinary search in Alfresco Explorer search control. User gets folders in search results no mater if he have rights on parent folder, it is ok.

But did you even try to use Alfresco Share? (I have information that Alfresco will develop further Share app, Explorer will only be maintained until the EOL)
If I try to use the same settings on Alfresco Share, and if my root "Company Document" folder is created as site (Alfresco site is normal folder, with some additional features - e.g. users get better preview in A.Share, with wiki, site dashboard,etc), there is no way to setup the same configuration.
If I setup "Company Documents" folder not to inherit "Everybody-Consumer" (because everybody will not have rights to search all documents in company), users will not have option to see site at all! (my expectation was that users will see the site, but only containing folders that are allowed for them). So, I tried to allow "Everybody-Consumer" to site "Company Documents", but to disallow inheritance to one level bellow (folder "documentLibrary" which is automatically created under site), and to allow to "documentLibrary" my custom security policy (director-consumer etc), which should be inherited. So, my beyond folder levels (HR documents, IT documents) should inherit director-consumer, and add security settings for their own groups which should have access to them.
But, this settings do not work at all! I get "no documents" message for each user (only director can see documents because he has rights on parent folder "documentLibrary").

So, my conclusion is that I'm trying to setup very basic thing in Alfresco (inheritance with security model) and I have no idea to setup that in Alfresco Share.
In Alfresco Explorer it is possible with search feature, in Share, I don't see the option.

Best regards,
Ivana